PAN-OS 12.1.2 Features - Operational and Performance Impact of Brotli Inspection and DNS Security Logging

[R.Tabira]

Attention: Global TPM team,

Hello Team,

I would like to confirm the operational and performance impact of the following features introduced in PAN-OS 12.1.2:

1. Brotli-compressed content inspection using the Content-Based Threat Detection (CTD) engine

2. Dedicated DNS Security log type for improved DNS visibility

Could you please advise on the following points for each feature?

1. Impact on existing traffic flows when enabled

2. Expected impact on CPU, memory utilization, throughput, latency, or overall firewall performance

3. Known operational considerations, including potential false positives or traffic blocking behavior

4. Whether enabling the feature requires any changes to existing Security Policies, Security Profiles, Decryption settings, or other configurations

5. Recommended validation steps before and after enablement

6. Whether the feature can be safely disabled and reverted if issues are observed after enablement

Additionally, are there any documented best practices, limitations, caveats, or deployment considerations that should be reviewed before enabling these features?

Thank you.

[OtakarKlier]

Hello,

Here are my thoughts:

1. Impact on existing traffic flows when enabled

• There could be blocked traffic depending on policies etc.

2. Expected impact on CPU, memory utilization, throughput, latency, or overall firewall performance

• There will be a hit depending on your model and traffic flowing through it.

3. Known operational considerations, including potential false positives or traffic blocking behavior

• There could be some but I dont run into them often.

4. Whether enabling the feature requires any changes to existing Security Policies, Security Profiles, Decryption settings, or other configurations

• Yes, you need to set your security policies to use the features.

5. Recommended validation steps before and after enablement

• Go slow and take your time. Enable one and monitor (could be days or weeks depending on your traffic and appetite for potential blocks)

6. Whether the feature can be safely disabled and reverted if issues are observed after enablement

• Absolutly, you nca revert the configuration to a previous one before you enabled this.

Additionally, are there any documented best practices, limitations, caveats, or deployment considerations that should be reviewed before enabling these features?

• Go slow and take your time. enable logging at session end on all of your security policies so you can see the traffic wether it was allowed or blocked.

Take your time and get change control approval or management approval in writing.

Regards,